DKIM record checker
Look up the DKIM key at selector._domainkey.yourdomain.com and check that it's valid and long enough. Don't know the selector? Leave it empty and the checker tries 60+ common ones. Free, no sign-up.
How to find your DKIM selector
- Send yourself an email from the service you want to check.
- Open the original message (Gmail: ⋮ → Show original; Outlook: View message details).
- Find the
DKIM-Signatureheader.s=is the selector andd=the signing domain. For DMARC,d=must be your domain or one of its subdomains.
Or send a test email: it shows the selector and whether DKIM passed on a real message.
Default selectors of common providers
| Google Workspace | google (TXT, made in the Admin console) |
|---|---|
| Microsoft 365 | selector1 and selector2 (CNAMEs to your tenant) |
| Zoho Mail | you name it when you add DKIM (Zoho's example is zmail) |
| Mailchimp | k2 and k3 (CNAMEs) |
| SendGrid | s1 and s2 (CNAMEs) |
| Amazon SES | three random CNAME selectors made when you verify the domain |
What this DKIM check tests
- A key exists at the selector and has a public key (
p=). An emptyp=means the key was revoked and can't sign mail. - Key length: 1024-bit keys still pass, but 2048-bit is the current recommendation.
- Without a selector: your provider's default selectors (detected from MX) and 60+ common ones. A miss doesn't prove DKIM is off, because selector names aren't public.
Common DKIM problems
- DKIM is not switched on in the email service. Publishing the record is only half: signing has to be enabled too (Google Admin console, Microsoft Defender portal, etc.).
- Microsoft 365 CNAMEs missing, so
selector1._domainkeydoesn't resolve. - DKIM passes for the wrong domain. Mail is signed with the service's domain (
d=sendgrid.net), so DMARC fails: 550 5.7.32. Authenticate your own domain in that service. - Key pasted with quotes or line breaks in the wrong place. Long keys are split into 255-character strings in one TXT record; most DNS panels do that for you.
- Bounce: Gmail 550 5.7.30 (DKIM failed).
Check SPF, DMARC and everything at once on the deliverability checker.
Rather have it fixed for you? I check your domain by hand and email you the exact SPF, DKIM and
DMARC records for every service that sends your mail, with click-by-click steps for your DNS host. Then I re-check until they pass.
Get it fixed: $29
Get it fixed: $29
Pay by card, no account needed. Within 24 hours; not fixed, full refund. Prefer Fiverr? · Do it yourself with the Fix Kit ($15)
After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.
Did this fix it?